The Bank of England and City regulators have set out new rules to “bolster the resilience” of IT to financial firms in a bid to cut the risks of cyber-attacks or power outages.
The BoE along with the Financial Conduct Authority, and the Prudential Regulation Authority have laid out how they intend to use new powers, given to them by government last year, to oversee digital providers who service the financial services industry.
The FCA says: “Financial firms and financial market infrastructures, such as payment systems, have become increasingly reliant on the services of a small number of third-party providers, known as critical third parties.
“While these third parties can enhance competitiveness for the sector, disruption or failure to one of them—such as a cyber-attack or power outage—could affect a large number of consumers and firms, and threaten the stability of the UK financial system.”
The new rules will require critical third parties to:
- Provide regular assurance, information and notifications to the financial regulators on their services
- Undertake various forms of resilience testing and scenario-based exercises, including collaborating on some with their firms and financial market infrastructures
- Report major incidents like cyber-attacks, natural disasters and power outages
These measures come into effect on 1 January next year.
The government will decide which third parties fall under the new regime based on advice from regulators.
A joint statement by FCA chief executive Nikhil Rathi, BoE deputy governor Sarah Breeden and PRA chief executive Sam Woods says: “The regime will not change the accountability of financial services firms, their boards and senior management for remaining operationally resilient, including when they rely on services provided by third parties.”
They add: “Managing the risk of disruption to the services that firms and, by extension, consumers and markets, rely on is vital for safeguarding the UK’s reputation for stable and secure financial services, which underpins the UK’s attractiveness as a place to do business.”
